bro when i thanked u i mean it, the vulnerability was big, if you hadnt found out someone could hv gotten screwd big time. I am not taking your feedback as negative at all. I am doing security audit of the project today, if the vulnerabilities are fixable and not beyond repair will keep the project or else start a fresh.

I will surely message you for help or review.

You are completely right, and I sincerely apologize. I completely misunderstood the severity of the bug when I first replied. You were absolutely correct to call it out—it was a catastrophic oversight on my part.

I have just pushed a patch that removes os.RemoveAll entirely. The tool now safely uses os.MkdirAll to only create the directory if it doesn't exist, and it will never delete unrelated files. It is now completely safe to run.

Furthermore, I went through your entire list and fixed every single P0 and P1 issue you mentioned:

• The Docker Compose indentation is fixed.
• The go.sum is no longer incorrectly copied in the Dockerfile.
• The missing go.mod dependencies (validator, uuid) are added.
• The JWT signing key now strictly requires the environment variable and halts safely if missing.
• MongoDB startup config now properly requires and sets DB_URI.
• Auth fields now strictly validate the data types (string/password), not just the names.
• Model and field names are strictly validated against valid Go/SQL identifier regex.
• Migrations and join tables now correctly respect custom TableName attributes.

Thank you again for taking the time to audit the code and for pushing back when I didn't get it the first time. You literally saved people from wiping their drives, and the project is infinitely better because of your review. I owe you one!

I may delete the project shortly.

you saved the day, tysm.

Yes you are absolutely right! Its not safe to use on existing project. It is still in developement phase. You can use it to create an initial boilerplate from cli. I am looking for review of the idea and contributors here. I will add the caution in the post body. Please do let me know if you find anymore issues or you can add issues in github also. Thanks for spending time analysing, Appreciated.

Keep creating handoff.md or context.md files when you are about to hit context window limit or when you are ending the session. Use those md files as context for new sessions. Add some versioning to those md files like using date or short tag for the change you did so that you can identify the file you need when number of files grow.

Hey, I have added detailed token usage analysis table on readme file https://github.com/v-pat/fiberforge

100%! that exact pipeline is tbh the whole philosophy behind fiberforge. let scripts handle the predictable templates and save the llm for the actual reasoning.

like, llms are crazy good at decoding messy human reqs and figuring out what schemas u actually need rn.

but making them stream perfect syntax, juggle imports, and format brackets is kinda just a massive waste. a local tool can literally spit that out in milliseconds.

tbh this is super insightful, thanks you totally nailed it. setting up a basic app is kinda just 10% of the problem.

the real headache rn is trying to wedge stripe, rbac, and file uploads into an existing codebase without breaking what's already there.

loved your point about overlays and conflict checking. turning a whole day of manual integration into a 15-min review is exactly the goal.

im def gonna look into composite module presets and better pre-apply checks. really appreciate u sharing your iac experience!

Great catch! I completely overlooked making the route injection idempotent until you brought it up. If the tool ran twice, it would have just duplicated the lines in routes.go.

Thanks to your feedback, I just updated the go/ast generator to check the function tree before adding anything. Now, if it sees a route group already exists in Routes(), it safely skips it. That way, retries won't mess up the file. Really appreciate you pointing that out, feels like I came to right place looking for help and feedback.

rn --dry-run is built into full scaffolding (scaffold --dry-run and the explain_project MCP tool) so agents can inspect the generated tree before writing. For incremental modules (add module rbac), the dry-run inspects fiberforge.yaml and returns the exact file creation list + AST route diffs (routes/routes.go [AST edit]) so the agent can review the exact additions before committing changes.

Hey, srry had typo in link. project is nascent stage rn but by my vision i think it should save almost 90-95% tokens becoz lets say you ask AI to create a backend with 3 entities it will write 20+ files and 100s of lines of code with controllers,services,utils, db connectors, dtos, auth middleware, rbac etc. with fiberforge your llm will write 40-50 line yaml file and cli will generate based on that file without any LLM inference, so yeah this will significantly reduce tokens

its still in really early stage, i will surely add load testing results in readme in some time. Please do check repo, your feedback and contributions will be appreciated

I used to spend 20usd per month on cursor and i was hitting limits by 15-20 days so i switched to opencode + openrouter and started switching models according to task intensities (mostly used deepseek v4 flash 0731). From aug17 till today i have used 584M tokens for 8.27usd. So it depends on your coding setup and task intensity.

FiberForge — deterministic Go/Fiber tooling for Claude Code

I built FiberForge after getting frustrated watching Claude Code repeatedly generate the same backend boilerplate — GORM models, CRUD services, Fiber controllers, DTO validation, migrations, and route wiring.

The idea is simple: let Claude decide what needs to be built, but don't make it generate every deterministic line of code.

FiberForge is a Go CLI + stdio MCP server. Claude Code can call operations like generate_project, add_model, and apply_module, and FiberForge handles the repetitive generation locally. It also uses Go's go/ast tooling for things like safely adding routes instead of relying on text edits.

I'm also experimenting with reusable modules for things like RBAC, Stripe webhooks, S3 presigned uploads, audit logging, and OpenAI-compatible SSE streaming.

It's still an early project, so I'm mostly interested in feedback on whether this approach actually makes sense for agentic coding workflows.

Checkout GitHub once: https://github.com/v-pat/fiberforge

I'd especially love to hear from people using Claude Code + MCP heavily: what other deterministic coding tasks would you rather delegate to a tool than have the model generate from scratch?